| From foo@baz Wed Aug 26 04:19:14 PM CEST 2020 |
| From: Miaohe Lin <linmiaohe@huawei.com> |
| Date: Sat, 15 Aug 2020 04:44:31 -0400 |
| Subject: net: Fix potential wrong skb->protocol in skb_vlan_untag() |
| |
| From: Miaohe Lin <linmiaohe@huawei.com> |
| |
| [ Upstream commit 55eff0eb7460c3d50716ed9eccf22257b046ca92 ] |
| |
| We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). So |
| we should pull VLAN_HLEN + sizeof(unsigned short) in skb_vlan_untag() or |
| we may access the wrong data. |
| |
| Fixes: 0d5501c1c828 ("net: Always untag vlan-tagged traffic on input.") |
| Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/core/skbuff.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/net/core/skbuff.c |
| +++ b/net/core/skbuff.c |
| @@ -4591,8 +4591,8 @@ struct sk_buff *skb_vlan_untag(struct sk |
| skb = skb_share_check(skb, GFP_ATOMIC); |
| if (unlikely(!skb)) |
| goto err_free; |
| - |
| - if (unlikely(!pskb_may_pull(skb, VLAN_HLEN))) |
| + /* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */ |
| + if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short)))) |
| goto err_free; |
| |
| vhdr = (struct vlan_hdr *)skb->data; |
